This write-up is the walkthrough for OVERTHEWIRE NATAS level 12 to level 14. Both these levels contain upload the image kind of challenges where we have to upload a shell bypassing the code.

LEVEL 12 – 13:

The above image is the screen for overthewore natas challenge 12, When you click on “View sourcecode”, this is what you will find:

The marked number 1 is the php function that checks the size of the file, This file that we upload is renamed using a random function which is written above and the random path is also formed with path “/uploads/”. If you see closely, the number 2 code is the html form code and it takes 2 hidden values, the size and the random name created by php genRandomString() function.

I started burp suite to change the values of the submitted form. In the highlighter strings below,I made the changes.

fi70lbrlhp.jpg was the random name the function generated. I changed the Extension to .php.
pic.php is the actually file, I uploaded which contains the highlighted php code above.

This is the php code used in pic.php file, the one I have uploaded:

<?php echo passthru('cat /etc/natas_webpass/natas13'); ?>

Forward the request.

Click on the generated link above and the password for level 13 will be echoed. 

LEVEL 13-14:

The level is very much similar to level 12, The only difference is that the security is bit high. The file content is checked if it is a image file or not. If you click the view sourcecode button, you will see the code is very similar to level 12 but the only added line is exif_imagetype function, which checks the type of file.

This time, I uploaded an actual image file.
Burpsuite intercept the request:

I changed the number 1 from jpg to php  and at number 2, with the content of the image itself, I added a small php code:

<?php echo "<br>"; system("cat /etc/natas_webpass/natas14"); ?>

click on the generated link and the password will appear.